Commits

main

Pin openvibe-publishing v1.1.0 and sync STATUS with pins (#5)OpenVibers · 3 Oct 2026 4e453be
Bump openvibe-shared v2.3.1 → v2.5.0 (#4)OpenVibers · 3 Oct 2026 fcd6632
Move Wiki errors and shutdown onto openvibe-sdk/service (#3)OpenVibers · 2 Oct 2026 60b51a8
Serve cache headers through openvibe-shared cache-policy (#2)OpenVibers · 2 Oct 2026 f088ee1
The Wiki home opens with what OpenVibe.Wiki is for (plan T11, D92; openvibe-shared v2.3.1 showcase): 'Knowledge, with sources', where to start (start a space, or sign in to), and the six things a space gets today (page trees, revision history, citations, Community discussion, roles and visibility, search and feeds); the spaces and recent pages follow. The kit's stylesheet is linked on the home only. Home budgets raised as a decision (html 27.5 KB, css 18 KB). Suites green.OpenVibers · 29 Sept 2026 c6e6f4d
Wiki tells search engines when a page changes (plan T11, IndexNow): with INDEXNOW_KEY set the key file is served at /<key>.txt and an indexable page appearing, changing or going away pings the engines (its path and the sitemap); drafts, private and noindex pages never; unset, nothing is mounted or sent. A home-page performance budget runs in CI where there was none. Tests green (verified).OpenVibers · 29 Sept 2026 31f8ee0
Wiki moves between its pages without a reload (plan T11): openvibe-shared v2.2.0 boost swaps <main> styles-first with the shared transition, prefetching on intent, and does a normal load across a deploy (the ov-boost marker carries the release). The navbar's sign-in returns to the current page. Tests pin the marker, the boost tag and the login template (verified).OpenVibers · 29 Sept 2026 f36c942
The perf-budget test boots its server on its own PGlite directory (WIKI_PGLITE_DIR, a temp dir removed afterwards) with DATABASE_URL cleared: it used to fall back to the shared dev database data/pglite and migrate it. The exit wait is registered at spawn and raced against 12 s, so a server that crashed before the checks fails the test instead of ending it as a pass, and its database is removed only after it has exited. Found by the estate-wide floating-promise sweep; reviewed independently (its blocker, the exit wait, fixed here). npm test 32/32 test files passed.OpenVibers · 29 Sept 2026 186baef
The SQLite era is gone (on PostgreSQL since 2026-09-28; no compatibility kept): the one-time migrate-to-postgres script, WIKI_DB_PATH/dbPath (config, .env.example, systemd unit, test helpers), the unused better-sqlite3 dependency and its lockfile entries, and docs, docstrings and STATUS lines about SQLite or its rollback window. Reviewed independently (VERDICT: SHIP). npm test 32/32 test files passed.OpenVibers · 29 Sept 2026 fed2477
Await what the transactions start (PostgreSQL pass follow-up): the viewer resolver, page routes, the projects module and ~40 service call sites used async store calls without await (some inside transactions). A sync callback that calls async code returns before the work is done, so writes could land outside or after their transaction. npm test 32/32.OpenVibers · 29 Sept 2026 267fd69
openvibe-shared v1.29.2 (from its earlier pin): navbar dropdowns are no longer clipped by the links row, changing the theme repaints the page background, bright accents get dark button text (WCAG), the navbar brand is more compact. npm test: 32/32 test files passedOpenVibers · 29 Sept 2026 1dbd2f0
openvibe-shared v1.28.1 (from its earlier pin): the account panel keeps its sections' height on phones, the codes mark at rest shows its V, no empty space under the footer on phones. npm test: 32/32 test files passedOpenVibers · 29 Sept 2026 727fefb
openvibe-shared v1.27.0 (from v1.25.0): an async route handler's rejection now reaches the error handler instead of ending the process. Express 4 leaves such a promise unhandled and Node 22 exits on it; instrument() now applies openvibe-shared/express-async. 1.26.0 adds async gauge collects. npm test: 32/32 test files passed.OpenVibers · 28 Sept 2026 95fd80c
Wiki moves to PostgreSQL and Valkey (ADR-035, roadmap WS-X2, repository-pass group G1), async from end to end.OpenVibers · 28 Sept 2026 ec90476
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner (same files, one at a time as before, 60 s timeout per file): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs; README and STATUS.json follow). npm test (Node 22) 32/32.OpenVibers · 28 Sept 2026 a81573f
README and STATUS.json are current (roadmap WS-U task 3): the README gains Capabilities (the eight implemented capabilities and the grants Wiki uses at Events, Community, Sources, Media and VIP), Security (SECURITY.md, the threat review, auth, private data, egress, secrets by name) and Deploy (sudo ovhost deploy wiki, unit, port, env file, database, vhost, rollback) sections; the API note and Depends on name the current pins (contracts v0.64.0, publishing v0.4.0, shared v1.22.0, sdk v0.12.0) and VIP. STATUS.json names openvibe-contracts v0.64.0, gains features and is updated 2026-09-28.OpenVibers · 28 Sept 2026 3302540
Per-actor rate limits on Wiki's /api/v1 and its editing forms (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/http/actor-limits.js makes one limiter per app and counts requests once req.actor is resolved. A person counts as user:usr_…, whether they use their own token or cookie, a service names them in X-OV-Subject, or an app acts for them through on_behalf_of. A first-party service relaying a signed-out visitor counts by the address it forwards. A service or app acting as itself, such as an AI workflow's proposals, counts by its principal. A signed-out caller counts by address. A first-party service reading for itself is not counted on reads, since its pages speak for all its visitors and the per-address /api/ limit already bounds it. Past a limit a route answers 429 problem+json rate_limited with Retry-After before any work (for a form, before its body is read), logs one [Limits] line and counts wiki_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 32a26ef
Security regression suites for the four classes that apply to the Wiki (roadmap WS-R task 5). test/security-crawl.js lists every route of the booted app from Express's router stack (a route added later is crawled without anyone listing it), fills parameters with seeded values and GETs each path as several people, with the session cookie and the bearer token.OpenVibers · 26 Sept 2026 1e311db
VIP spaces and pages (roadmap WS-K task 8; Contracts 0.64.0, pinned from 0.49.0). A new visibility, vip: read by the space's roles and by the viewers OpenVibe.VIP admits as members of the space owner (vip.resource.policy.evaluate; resource wiki/page when the page itself is VIP-only, else wiki/space; fallback wiki:gated_page, so an owner's VIP rule wins). The decision is made before render: route params trigger access.prepareVip, which records the answers on the actor for the synchronous checks (cached through openvibe-sdk/vip; the JSON export asks authoritatively). Others get a join prompt (403, never cached) linking to the owner's VIP plans, and every doubt refuses. VIP content never reaches search, sitemaps, feeds or another viewer's lists. Official spaces refuse vip. Existing databases get their visibility CHECK widened in place at startup (writable_schema in one transaction, integrity-checked; tried on a copy of production). test/vip-gate.test.jsOpenVibers · 26 Sept 2026 c76d051
The notification bell hears new notifications as they happen (notificationsRealtime; Shared 1.22.0, roadmap WS-E task 3): Network's network.notification.created over OpenVibe.Events' realtime stream, with polling as the fallback. Only a signed-in bell with a Network token opens a stream.OpenVibers · 26 Sept 2026 0bb8400
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 38a17bd
Open redirect fixed (roadmap WS-R task 5): the sign-in next let "/<TAB>/evil.com" through, which browsers read as "//evil.com" (they drop tab and newline characters and read a backslash as "/"); any control character or backslash in next now goes home. test/open-redirect.test.js feeds it the known bypassesOpenVibers · 26 Sept 2026 e0337a6
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 123bd4f
Static assets are immutable only when ?v= is the served file's hash (roadmap WS-P task 10): any ?v= used to be cached for a year, so after a deploy or a rollback an older page's URL could pin the wrong bytes; other ?v= values and plain URLs now get a 5-minute cache, like Blog, Codes and the othersOpenVibers · 26 Sept 2026 255de21
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 1747009
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 7cd86c5
Pins: openvibe-shared 1.16.0 -> 1.16.1 (the OV mark stops animating when idle, hidden or off-screen)OpenVibers · 26 Sept 2026 40c54a0
A guest's session probe answers 200, not 401 (browser check, WS-Q task 3): GET /auth/me with no session credential at all answers { user: null }, which the shared navbar reads as signed out. It asks on every page view, and the 401 logged a console error on each. A credential that is present but invalid or expired still answers 401. Test: auth.test.js (the guest case used to expect 401)OpenVibers · 26 Sept 2026 9409f51
The CSP allows Cloudflare Web Analytics (browser check, WS-Q task 3): script-src https://static.cloudflareinsights.com loads the beacon Cloudflare injects at the edge, connect-src https://cloudflareinsights.com is where it reports. The network's privacy text already says Cloudflare may measure performance, and Live and Tools allow it; here the policy blocked it and every page view logged a CSP error.OpenVibers · 26 Sept 2026 46bac64
Pins: openvibe-shared 1.15.0 -> 1.16.0OpenVibers · 26 Sept 2026 679aba4

More commits